Free CISM Exam Braindumps
Certified Information Security Manager Questions 791–795 (page: 160)

Updated On: 10-Feb-2026

When developing an incident response plan, the information security manager should:

  1. include response scenarios that have been approved previously by business management.
  2. determine recovery time objectives (RTOs).
  3. allow IT to decide which systems can be removed from the infrastructure.
  4. require IT to invoke the business continuity plan.

Answer(s): B



To implement a security framework, an information security manager must FIRST develop:

  1. security standards.
  2. security procedures.
  3. a security policy.
  4. security guidelines.

Answer(s): D



An organization is planning to open a new office in another country. Sensitive data will be routinely sentbetween two offices. What should be the information security manager’s FIRST course of action?

  1. Identify applicable regulatory requirements to establish security policies.
  2. Update privacy policies to include the other country’s laws and regulations.
  3. Apply the current corporate security policies to the new office.
  4. Encrypt the data for transfer to the head office based on security manager approval.

Answer(s): A



As part of an international expansion plan, an organization has acquired a company located in another jurisdiction. Which of the following would be the BEST way to maintain any effective information security program?

  1. Ensure information security is included in any change control efforts
  2. Merge the two information security programs to establish continuity
  3. Determine new factors that could influence the information security strategy
  4. Implement the current information security program in the acquired company

Answer(s): C



An organization with a maturing incident response program conducts post-incident reviews for all major information security incidents. The PRIMARY goal of these reviews should be to:

  1. document and report the root cause of the incidents for senior management.
  2. identify security program gaps or systemic weaknesses that need correction.
  3. prepare properly vetted notifications regarding the incidents to external parties.
  4. identify who should be held accountable for the security incidents.

Answer(s): A



Viewing page 160 of 345
Viewing questions 796 - 800 out of 1716 questions


Post your Comments and Discuss ISACA CISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!